CLAIMS 



1 1 . A computer controlled method to construct a secure credential infrastructure 

2 comprising steps of: 

3 exchanging key commitment information over a preferred channel between a 

4 credential issuing device and a prospective member device to pre-authenticate said 

5 prospective member device; 

6 receiving a public key from said prospective member device; 

7 verifying said public key with said key commitment information; and 

8 automatically provisioning said prospective member device with a credential 

9 authorized by a credential issuing authority. 

1 2. The computer controlled method of claim 1 , further comprising establishing proof 

2 that said prospective member device is in possession of a private key corresponding 

3 to said public key. 

1 3. The computer controlled method of claim 2, further comprising establishing a 

2 communication channel between said prospective member device and said 

3 credential issuing authority responsive to the step of establishing proof. 

1 4. The computer controlled method of claim 3, wherein said credential is secret and 

2 said communication channel is a secure communication channel. 

1 5. The computer controlled method of claim 1, further comprising configuring said 

2 credential issuing authority. 

1 6. The computer controlled method of claim 1 , wherein said credential issuing device 

2 includes said credential issuing authority. 
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1 7. The computer controlled method of claim 1 , wherein the step of exchanging further 

2 comprises sending network configuration information to said prospective member 

3 device. 

1 8. The computer controlled method of claim 1, wherein the step of automatically 

2 provisioning further comprises steps of: 

3 determining provisioning information for said prospective member device; 

4 and 

5 sending said provisioning information to said prospective member device. 

1 9. The computer controlled method of claim 8, wherein said provisioning information 

2 further comprises application-specific configuration information. 

1 10. The computer controlled method of claim 1 , wherein said preferred channel is a 

2 location-limited channel. 

1 11. The computer controlled method of claim 1 , wherein said preferred channel uses a 

2 telephone switching system. 

1 12. The computer controlled method of claim 1, wherein said preferred channel has a 

2 demonstrative identification property and an authenticity property. 

1 13. The computer controlled method of claim 1, wherein said key commitment 

2 information is selected from one or more of the group consisting of a portion of 

3 said public key, said public key, an encoding of said public key, and a mathematical 

4 function of said public key. 

1 14. The computer controlled method of claim 1, wherein the step of automatically 

2 provisioning is performed by said credential issuing device. 

1 15. The computer controlled method of claim 1 , wherein the step of automatically 

2 provisioning is performed by an enrollment station in communication with said 

3 credential issuing device. 

Page: 37 



1 1 6. The computer controlled method of claim 1 5, wherein the method further comprises 

2 establishing secure communication between said enrollment station and said 

3 credential issuing device. 

1 1 7. The computer controlled method of claim 1 , wherein said prospective member 

2 device is selected from one or more of the group consisting of a computer, a 

3 personal data assistant, a smart card, a cryptographic token, a medical device, a 

4 device containing personal information, a secure telephone, a cell telephone, a 

5 vehicle, a container, an access card, a biometric sensor, a wireless network device, a 

6 proximity sensor, a sensor device, traffic sensor, an alarm device, a robot, a device 

7 capable of receiving a credential, a device capable of issuing a credential. 

1 1 8. The computer controlled method of claim 1 , wherein said secure credential 

2 infrastructure is a public key infrastructure, said credential issuing authority is a 

3 certification authority and said credential is a public key certificate. 

1 1 9. The computer controlled method of claim 1 8, wherein the step of automatically 

2 provisioning further comprises steps of: 

3 determining provisioning information for said prospective member device; 

4 creating a public key certificate as said credential responsive to said 

5 provisioning information; and 

6 sending said public key certificate to said prospective member device. 

1 20. The computer controlled method of claim 18, wherein the step of exchanging 

2 further comprises steps of: 

3 creating a public key pair for said prospective member device; and 

4 sending said public key pair to said prospective member device over said preferred 

5 channel. 
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1 21. The computer controlled method of claim 1 8, further comprises steps of: 

2 creating a trusted key pair; 

3 storing said trusted key pair; 

4 establishing a certification authority public key certificate; and 

5 storing said certification authority public key certificate. 

1 22. The computer controlled method of claim 2 1 , wherein the step of automatically 

2 provisioning is responsive to authorization from a registration agent. 

3 

1 23. A computer-readable storage medium storing instructions that when executed by a 

2 computer cause the computer to perform a method to construct a secure credential 

3 infrastructure, the method comprising steps of: 

4 exchanging key commitment information over a preferred channel between a 

5 credential issuing device and a prospective member device to pre-authenticate said 

6 prospective member device; 

7 receiving a public key from said prospective member device; 

8 verifying said public key with said key commitment information; and 

9 automatically provisioning said prospective member device with a credential 
10 authorized by a credential issuing authority. 

1 24. The computer-readable storage medium of claim 23, wherein said public key is 

2 received over said preferred channel. 
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1 25. The computer-readable storage medium of claim 23, wherein the step of 

2 automatically provisioning further comprises steps of: 

3 determining provisioning information for said prospective member device; 

4 and 

5 sending said provisioning information to said prospective member device. 

1 26. The computer- readable storage medium of claim 23, wherein the step of 

2 exchanging is initiated by said prospective member device. 

1 27. The computer-readable storage medium of claim 23, wherein the step of 

2 exchanging is initiated by said credential issuing device. 

1 28. The computer-readable storage medium of claim 23, wherein the step of 

2 automatically provisioning is performed by said credential issuing device. 

1 29. The computer-readable storage medium of claim 23, wherein said prospective 

2 member device is selected from one or more of the group consisting of a computer, 

3 a personal data assistant, a smart card, a cryptographic token, a medical device, a 

4 device containing personal information, a secure telephone, a cell telephone, a 

5 vehicle, a container, an access card, a biometric sensor, a wireless network device, a 

6 proximity sensor, a sensor device, traffic sensor, an alarm device, a robot, a device 

7 capable of receiving a credential, a device capable of issuing a credential. 

1 30. The computer-readable storage medium of claim 23, wherein said secure credential 

2 infrastructure is a public key infrastructure, said credential issuing authority is a 

3 certification authority and said credential is a public key certificate. 
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1 31. A credential issuing apparatus configured to construct a secure credential 

2 infrastructure comprising: 

3 at least one port configured to establish a preferred channel; 

4 a key commitment receiver mechanism configured to receive key commitment 

5 information through said at least one port; 

6 a key receiver mechanism configured to receive a public key; 

7 a pre-authentication mechanism configured to verify said public key with said 

8 key commitment information; and 

9 a credential provisioning mechanism configured to be able to automatically 

10 provide a credential authorized by a credential issuing authority responsive to the 

1 1 pre-authentication mechanism. 

1 32. The apparatus of claim 3 1 , wherein said public key is received over said preferred 

2 channel. 

1 33. The apparatus of claim 3 1 , further comprising a key-pair validation mechanism 

2 configured to establish proof that a prospective member device is in possession of a 

3 private key corresponding to said public key. 

1 34. The apparatus of claim 3 1 , further comprising an initialization mechanism 

2 configured to configure said credential issuing authority. 

1 35. The apparatus of claim 31 , wherein said credential issuing device further comprises 

2 said credential issuing authority. 

1 36. The apparatus of claim 3 1 , further comprises a network device configuration 

2 mechanism configured to send network configuration information over said 

3 preferred channel. 
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1 37. The apparatus of claim 31 , wherein the credential provisioning mechanism further 

2 comprises: 

3 a determination mechanism configured to determine provisioning information 

4 for said prospective member device; and 

5 a transmission mechanism configure to send said provisioning information to 

6 said prospective member device. 

1 38. The apparatus of claim 3 1 , wherein said key commitment information is selected 

2 from the group consisting of a portion of said public key, said public key, an 

3 encoding of said public key, and a mathematical function of said public key. 

1 39. The apparatus of claim 31, wherein the credential issuing device is an enrollment 

2 station capable of being in communication with said credential issuing authority. 

1 40. The apparatus of claim 33, wherein said prospective member device is selected 

2 from one or more of the group consisting of a computer, a personal data assistant, a 

3 smart card, a cryptographic token, a medical device, a device containing personal 

4 information, a secure telephone, a cell telephone, a vehicle, a container, an access 

5 card, a biometric sensor, a wireless network device, a proximity sensor, a sensor 

6 device, traffic sensor, an alarm device, a robot, a device capable of receiving a 

7 credential, a device capable of issuing a credential. 

1 41 . The apparatus of claim 3 1 , wherein said secure credential infrastructure is a public 

2 key infrastructure, said credential issuing authority is a certification authority and 

3 said credential is a public key certificate. 

1 42. The apparatus of claim 41 , wherein the credential provisioning mechanism further 

2 comprises: 

3 a services determination mechanism capable of determining provisioning 

4 information for a prospective member device; 
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5 a certificate creation mechanism configured to create a public key certificate as 

6 said credential responsive to said provisioning information; and 

7 a sending mechanism capable of sending said public key certificate to said 

8 prospective member device. 

1 43. The apparatus of claim 41, wherein the key commitment receiver mechanism 

2 further comprises: 

3 a key creation mechanism capable of creating a public key pair for a 

4 prospective member device; and 

5 a sending mechanism capable of sending said public key pair to said 

6 prospective member device over said preferred channel. 

1 44. The apparatus of claim 41, further comprising an automatic configuration 

2 mechanism comprising: 

3 a key pair creation mechanism configured to create a trusted key pair; 

4 a key pair storage mechanism configured to store said trusted key pair; 

5 a public key certificate generation mechanism configured to establish a 

6 certification authority public key certificate responsive to said trusted key pair; and 

7 a certificate storage mechanism configured to store said certification authority 

8 public key certificate. 

1 45. The apparatus of claim 44, wherein the public key certificate generation mechanism 

2 further comprises a parent CA receiver mechanism configured to receive said 

3 certification authority public key certificate from a parent certification authority. 

1 46. A credential issuing apparatus configured to construct a secure credential 

2 infrastructure comprising: 

3 at least one port configured to establish a preferred channel; 
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4 a key commitment receiver mechanism configured to receive commitment 

5 information for a secret through said at least one port; 

6 a key receiver mechanism configured to receive said secret; 

7 a pre-authentication mechanism configured to verify said secret with said 

8 commitment information; and 

9 a credential provisioning mechanism configured to be able to automatically 

10 provide a credential authorized by a credential issuing authority responsive to the 

1 1 pre-authentication mechanism. 

12 

1 47. A computer controlled method to join a prospective member device with a secure 

2 credential infrastructure comprising steps of: 

3 exchanging key commitment information over a preferred channel between a 

4 credential issuing device and said prospective member device; 

5 receiving a public key by said prospective member device; 

6 verifying said public key with said key commitment information; and 

7 receiving a credential authorized by a credential issuing authority. 

1 48. The computer controlled method of claim 47, further comprising establishing proof 

2 that said credential issuing device is in possession of a private key corresponding to 

3 said public key. 

1 49. The computer controlled method of claim 48, further comprising establishing a 

2 communication channel between said prospective member device and said 

3 credential issuing authority responsive to the step of establishing proof. 

1 50. The computer controlled method of claim 47, wherein said secure credential 

2 infrastructure is a public key infrastructure, said credential issuing authority is a 

3 certification authority and said credential is a public key certificate. 
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1 51. The computer controlled method of claim 47, wherein said preferred channel is a 

2 location-limited channel. 

1 52. The computer controlled method of claim 47, wherein said preferred channel uses a 

2 telephone switching system. 

1 53. The computer controlled method of claim 47, wherein said preferred channel has a 

2 demonstrative identification property and an authenticity property. 

1 54. The computer controlled method of claim 47, wherein the step of exchanging is 

2 initiated by said prospective member device. 

1 55. The computer controlled method of claim 47, wherein the step of exchanging is 

2 initiated by said credential issuing device. 

1 56. The computer controlled method of claim 47, wherein said key commitment 

2 information comprises a portion of said public key. 

1 57. The computer controlled method of claim 47, wherein said key commitment 

2 information comprises a function of said public key. 

1 58. The computer controlled method of claim 50, further comprising receiving a public 

2 key pair by said prospective member device. 

1 59. The computer controlled method of claim 47, further comprising receiving 

2 provisioning information by said prospective member device. 

1 60. The computer controlled method of claim 47, wherein said prospective member 

2 device is selected from one or more of the group consisting of a computer, a 

3 personal data assistant, a smart card, a cryptographic token, a medical device, a 

4 device containing personal information, a secure telephone, a cell telephone, a 

5 vehicle, a container, an access card, a biometric sensor, a wireless network device, a 

6 proximity sensor, a sensor device, traffic sensor, an alarm device, a robot, a device 

7 capable of receiving a credential, a device capable of issuing a credential. 
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1 61. A computer-readable storage medium storing instructions that when executed by a 

2 computer cause the computer to join a prospective member device with a secure 

3 credential infrastructure, the method comprising steps of: 

4 exchanging key commitment information over a preferred channel between a 

5 credential issuing device and said prospective member device; 

6 receiving a public key by said prospective member device; 

7 verifying said public key with said key commitment information; and 

8 receiving a credential authorized by a credential issuing authority. 

1 62. The computer-readable storage medium of claim 6 1 , wherein said preferred channel 

2 uses a telephone switching system. 

1 63. The computer-readable storage medium of claim 61 , wherein the step of 

2 exchanging is initiated by said prospective member device. 

1 64. The computer-readable storage medium of claim 61 , wherein the step of 

2 exchanging is initiated by said credential issuing device. 

1 65. The computer-readable storage medium of claim 6 1 , wherein said key commitment 

2 information comprises a function of said public key. 

1 66. The computer-readable storage medium of claim 61 , wherein said prospective 

2 member device is selected from one or more of the group consisting of a computer, 

3 a personal data assistant, a smart card, a cryptographic token, a medical device, a 

4 device containing personal information, a secure telephone, a cell telephone, a 

5 vehicle, a container, an access card, a biometric sensor, a wireless network device, a 

6 proximity sensor, a sensor device, traffic sensor, an alarm device, a robot, a device 

7 capable of receiving a credential, a device capable of issuing a credential. 

8 
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1 67. An apparatus capable of joining a secure credential infrastructure comprising: 

2 at least one port configured to establish a preferred channel; 

3 a key commitment receiver mechanism configured to receive key commitment 

4 information though said at least one port; 

5 a key receiver mechanism configured to receive a public key; 

6 a pre-authentication mechanism configured to verify said public key with said 

7 key commitment information; and 

8 a credential receiving mechanism configured to receive a credential responsive 

9 to the pre-authentication mechanism. 

1 68. The apparatus of claim 67, further comprising a key-pair validation mechanism 

2 configured to establish proof that a credential issuing device is in possession of a 

3 private key corresponding to said public key. 

1 69. The apparatus of claim 68, further comprising a network interface configured to 

2 establish a communication channel with a credential issuing authority responsive to 

3 the key-pair validation mechanism. 

1 70. The apparatus of claim 67, wherein said secure credential infrastructure is a public 

2 key infrastructure, said credential issuing authority is a certification authority and 

3 said credential is a public key certificate. 

1 71 . The apparatus of claim 67, wherein said preferred channel is a location-limited 

2 channel. 

1 72. The apparatus of claim 67, wherein said preferred channel has a demonstrative 

2 identification property and an authenticity property. 

1 73. The apparatus of claim 67, wherein said key commitment information comprises a 

2 portion of said public key. 
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1 74. The apparatus of claim 67, wherein said key commitment information comprises a 

2 function of said public key. 

1 75. The apparatus of claim 70, further comprising a receiving mechanism capable of 

2 receiving a public key pair. 

1 76. The apparatus of claim 67, further comprising a receiving mechanism capable of 

2 receiving provisioning information. 

1 77. The apparatus of claim 67, further including one or more components selected from 

2 the group consisting of a computer, a personal data assistant, a smart card, a 

3 cryptographic token, a medical device, a device containing personal information, a 

4 secure telephone, a cell telephone, a vehicle, a container, an access card, a 

5 biometric sensor, a wireless network device, a proximity sensor, a sensor device, 

6 traffic sensor, an alarm device, a robot, a device capable of receiving a credential, a 

7 device capable of issuing a credential. 
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